Data Processing Addendum

This is a draft Data Processing Addendum (DPA). It is not signed, and it is not an offer you can accept by using the site. Organisation customers that need a DPA should email [email protected]. A lawyer should complete UK and EU transfer clauses before this is used in production.

Parties and roles

This draft is between:

• Startbase LTD (company number 15278821), registered office 24-26 Arcadia Avenue, FIN009, London, England, N3 2JU ("Processor" for Customer Content, "Controller" for Account Data as described in the Privacy Policy), and
• the organisation that has a paid or otherwise agreed ActionFlows account ("Customer").

Account Data means data about the Customer's users as users of ActionFlows (name, email, billing, logs of product use). Startbase is controller of Account Data.

Customer Content means data the Customer or its users put into flows, agents, credentials, artifacts, and similar product content. For Customer Content, the Customer is controller (or processor for its own clients) and Startbase is processor.

Subject matter and duration

Startbase processes Customer Content to provide the Platform described in the Terms and Conditions, for the term of the Customer's account and a short deletion period after closure.

Nature of processing: hosting, storage, transmission, execution of workflows and agents the Customer configures, support, security, and backup.

Types of personal data: whatever the Customer submits. Startbase does not want special category data unless a separate written agreement says so.

Data subjects: people whose data the Customer chooses to process through the Platform.

Instructions

Startbase processes Customer Content only on documented instructions from the Customer. The Product itself (flows, credentials, API calls the Customer configures) is the primary instruction. Written instructions by email to [email protected] are also instructions.

Startbase will tell the Customer if, in its opinion, an instruction infringes UK GDPR or EU GDPR, unless the law forbids that notice.

Confidentiality and security

People who process Customer Content for Startbase are under confidentiality duties. Security measures currently include access control, encryption in transit, encryption of stored credentials, backups, and staff access limited to what the job needs. No measure is perfect. Details: Privacy Policy.

Subprocessors

The Customer authorises Startbase to use the infrastructure providers listed on the Subprocessors page. Startbase will keep that page current. If the Customer objects to a new infrastructure subprocessor for legitimate data-protection reasons, the Customer's remedy is to stop using the affected feature or to close the account. Customer-chosen AI and integration providers are not Startbase subprocessors.

International transfers

Where Startbase transfers Customer Content from the UK or EEA to a country without an adequacy decision, it will use a lawful mechanism (typically the applicable standard contractual clauses) unless another mechanism applies. The signed DPA should attach the clause set a lawyer selects.

Assistance, breaches, deletion

Startbase will, taking into account the nature of processing, assist the Customer with data-subject requests, DPIAs, and breach notices that concern Customer Content, at the Customer's reasonable request.

If Startbase becomes aware of a personal data breach affecting Customer Content, it will notify the Customer without undue delay.

After the account ends, Startbase will delete or return Customer Content within the periods in the Privacy Policy, except data it must keep under law (for example invoice records).

Audits

On written request not more than once per year (unless a regulator requires more), Startbase will provide a reasonable summary of security measures. On-site audits only if that summary is not enough and the parties agree scope in writing. The Customer pays reasonable costs of an on-site audit.

Liability

Liability for this DPA follows the Terms and Conditions, except where data-protection law says a party cannot limit that liability.

Governing law

England and Wales, unless the signed version says otherwise.

How to execute

Email [email protected] from an organisation owner account. Do not treat this web page as a signed contract.